# Transferring ERC20 Vault tokens to another address and then withdrawing from the vault breaks `totalDeposit` accounting which is tied to deposit addresses

Vault ERC20 shares are transferable but totalDeposit accounting is tied to depositor addresses, letting share transfers bypass or lock the maxDeposit cap.

- Payout: Contest reward
- Severity: medium
- Program: Smilee Finance
- Credited: 3docSec
- Disclosed: 2024-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/39
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AM-4
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20 vault share token / deposit accounting
**Root cause:** totalDeposit is reduced proportionally to the withdrawing user's cumulative deposit, assuming the withdrawer is the original depositor; ERC20 share transfers break that assumption.
**Steps:**
1. Alice deposits up to maxDeposit (e.g. 1M USDC)
2. Alice transfers all shares except 1 wei to Bob via `vault.transfer(bob, shares-1)`
3. Alice calls `vault.initiateWithdraw(1)`; totalDeposit drops by her full cumulative deposit though only 1 wei share leaves
4. Alice deposits again, pushing real assets to 2x maxDeposit
5. Variant: Bob (non-depositor) withdraws all transferred shares, leaving totalDeposit inflated while vault assets are 0, blocking new deposits
**How found:** Code reading: noticed Vault inherits ERC20 (transferable shares) while _initiateWithdraw reduces totalDeposit by the withdrawer's cumulative deposit percentage, an assumption only valid if shares never move between addresses.
**Exploitation:** No capital beyond the deposit cap needed; attacker deposits to cap, transfers shares to a second address, then withdraws a dust share to zero out their cumulative deposit accounting while retaining assets, then re-deposits to exceed the cap. Alternatively a colluding address withdraws all shares to inflate totalDeposit and DoS deposits.
**Escalation:** Repeated cycles inflate totalDeposit arbitrarily, bypassing the admin's risk limit and locking the vault from deposits.
**Insight:** When a share/position token is transferable, any accounting keyed to the original depositor's address (cumulative deposit, reward debt, lock timers) can be desynced by moving the token; check every per-user accumulator against transferability.